Former Commodity Futures Trading Commission Chair Chris Giancarlo said the White House plan issued in August that allows companies to conduct limited cyber operations against criminal actors is, in his view, a "very mature, thoughtful document." Speaking on an episode of Unchained recorded on Oct. 26, Giancarlo said the memo was so tightly framed that it made him question whether his own earlier proposal had been too broad because it lacked similar restrictions.
Giancarlo said some people may argue the program does not go far enough. Even so, he backed the narrower approach, saying he likes the idea of starting small and building from there. For now, he said, the White House has "probably got it just about right," and the next step is to see how the program develops.
White House memo breaks from earlier privateering proposal
Giancarlo had taken a much broader position earlier. In a February 2025 op-ed written with Bits + Bips co-host Chris Perkins after the Lazarus Group’s $1.4 billion hack of Bybit, he called for letters of marque that would let American companies retrieve funds controlled by governments, entities, or individuals sanctioned by the Office of Foreign Assets Control, while shielding those firms from U.S. prosecution.
He also presented that idea at the White House Crypto Summit the following month.
The Aug. 12 memo moved away from that proposal on both fronts. It limits eligible targets to foreign criminal groups, not organizations that are an institutional part of a foreign government or wholly operated under a foreign government’s direction. A group is to be treated as non-state unless clear intelligence shows otherwise, a carve-out Unchained reported in August.
The memo also does not grant immunity. It specifically lists the Computer Fraud and Abuse Act among the laws that participants must follow.
Strict contractor screening and approval requirements
Under the memo, participants must be vetted contractors working with the Department of Justice or the Department of Homeland Security. They may also be required to post a bond or escrow of at least $1 million.
Each operation requires written approval from the program’s executive directors at DOJ and DHS.
Operating procedures were due by Oct. 11. As of Oct. 27, Unchained said it had found no public release of those procedures.
Escalation decisions stay with the government
Asked whether private cyber operations could escalate a conflict, Giancarlo said that risk is exactly why he sees the memo as prudent.
He said that may have been the core weakness in the earlier privateering approach: whether private companies should be trusted to make judgments about statecraft that have traditionally belonged to elected officials. Those decisions, he said, can be matters of life or death for many fellow citizens.
Ari Redbord, global head of policy at TRM Labs and a former federal prosecutor, made the same point on the episode. Under the memo, he said, any decision to escalate rests with DOJ and the government.
"So the private sector is not making that call," Redbord said.